Who is accountable when employees use unsafe access workarounds?

Why This Matters for Security Teams

Unsafe access workarounds are rarely just a user behaviour problem. They usually signal that the secure path is too slow, too brittle, or too disconnected from real operational pressure. When people copy credentials into chat, reuse tokens, or bypass approvals to keep work moving, the organisation has already lost control of the access design. That is why accountability sits with the programme that shaped the workflow, not only with the individual who took the shortcut.

This is especially true for NHI-heavy environments where service accounts, API keys, and agent credentials are used continuously. NHI Mgmt Group’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which means a workaround can become a privilege escalation path almost immediately. The control gap is not theoretical; it is structural, and it shows up when governance does not match operational reality. Guidance from the OWASP Non-Human Identity Top 10 also treats unmanaged identity sprawl and weak lifecycle controls as core risk drivers.

In practice, many security teams encounter the breach after the workaround has already been normalised as the fastest way to get work done.

How It Works in Practice

Accountability should be mapped across the full access lifecycle: policy design, workflow usability, approval latency, credential issuance, monitoring, and offboarding. If employees keep choosing unsafe paths, the design problem is usually in the system, not the person. That means IAM, security architecture, and operations need shared ownership for fixing the friction that makes the workaround attractive.

For NHIs and agentic workloads, this becomes even more important because access is often machine-speed and task-specific. Current guidance suggests using short-lived credentials, workload identity, and runtime policy checks so secure access is available when needed without making standing privileges the default. NHI Mgmt Group’s 52 NHI Breaches Analysis is a useful reminder that compromised identities often turn into broad lateral movement when secrets are reused or left valid too long.

• Use role definitions that reflect real tasks, not just organisational charts.
• Issue just-in-time access with automatic expiry and revocation.
• Log why the secure path was bypassed, then fix the bottleneck that caused it.
• Apply policy-as-code so approvals and entitlements are evaluated consistently.
• Review exceptions as design defects, not as routine administrative noise.

Operationally, the best practice is to treat every repeated workaround as evidence that the control is failing under load. That is the point where accountability shifts from user discipline to control ownership. These controls tend to break down in legacy environments with hard-coded service credentials and manual release processes because there is no fast, safe alternative when access is urgently needed.

Common Variations and Edge Cases

Tighter access controls often increase friction, so organisations have to balance misuse prevention against delivery speed. That tradeoff is real, and current guidance suggests the answer is not to relax controls indiscriminately but to reduce the pain of doing the right thing. In mature environments, the secure path is faster than the workaround, which is the only durable way to change behaviour.

There is no universal standard for this yet, but the direction of travel is clear: account for the system that created the shortcut. If a team cannot request, approve, and use access without bypassing policy, then governance, not frontline behaviour, is the root issue. The OWASP Non-Human Identity Top 10 and NHI Mgmt Group’s Ultimate Guide to NHIs — Key Challenges and Risks both point to the same operational lesson: excessive privilege, poor visibility, and weak lifecycle management turn shortcuts into incidents.

Exceptions do exist, especially in incident response or outage recovery, but they should be time-boxed, documented, and retrospectively reviewed. If workarounds are treated as acceptable because the workflow is “how things work here,” accountability has already failed at the programme level.

Related resources from NHI Mgmt Group

• Who is accountable when access controls create unsafe clinical workarounds?
• Who is accountable when hospital access controls create unsafe workarounds?
• How should healthcare organisations govern access for non-employees without slowing care delivery?
• Who should be accountable when access review escalations reach senior leadership?